CVE-2023-40151

In a configuration with authenticated users enabled (UDR-A), the device correctly requires authentication for incoming Sixnet UDR messages via UDP/IP. However, the same message sent via TCP/IP is accepted by the RTU without any authentication challenge — this constitutes a bypass of the access control mechanism. Additionally, when user authentication is not enabled at all, the system shell can execute commands with highest privileges. As a result, an attacker remotely, without authentication, gains full access to the device.

An attacker gains unauthorized, full access to the RTU device, enabling execution of arbitrary commands with highest privileges (RCE), manipulation of industrial processes, and potential disruption or destruction of controlled infrastructure.

Apply patches available from the manufacturer in accordance with references (Red Lion RLCSIM-2023-05 and CISA advisory ICSA-23-320-01). As a temporary measure, restrict access to RTU devices via TCP/IP using firewall or OT network segmentation, and ensure that user authentication is enabled on all devices.

Red Lion SixTRAK and VersaTRAK Series RTU: ST-IPM-6350 (firmware), ST-IPM-8460 (firmware), VT-MIPM-135-D (firmware) — specific versions indicated in manufacturer references